Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits

A a potential race condition reported by one of my customers that leads to
a NULL pointer dereference, where the call to efi.get_variable should be
guarded with efi_rt_services_supported() to ensure that function exists.

Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

authored by

Shenghao Ding and committed by
Takashi Iwai
b0035df5 71d2893a

+10
+5
sound/hda/codecs/side-codecs/tas2781_hda.c
··· 193 193 efi_status_t status; 194 194 int i; 195 195 196 + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { 197 + dev_err(p->dev, "%s: NO EFI FOUND!\n", __func__); 198 + return -EINVAL; 199 + } 200 + 196 201 if (hda->catlog_id < LENOVO) 197 202 efi_guid = tasdev_fct_efi_guid[hda->catlog_id]; 198 203
+5
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
··· 315 315 unsigned int attr; 316 316 int ret, i, j, k; 317 317 318 + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { 319 + dev_err(p->dev, "%s: NO EFI FOUND!\n", __func__); 320 + return -EINVAL; 321 + } 322 + 318 323 cd->cali_dat_sz_per_dev = TAS2563_CAL_DATA_SIZE * TASDEV_CALIB_N; 319 324 320 325 /* extra byte for each device is the device number */